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Three apparently unrelated problems which have no solution using classical tools are described: 
the 'W-strangers," "secret sharing," and "liar detection" problems. A solution for each of them 
is proposed. Common to all three solutions is the use of quantum states of total spin zero of 
spin-(A'^ — l)/2 particles. 
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Not long ago, during a meeting on quantum informa- 
tion, a speaker asked the participants to make a list of 
"interesting" quantum states, namely, those which have 
potential applications (particularly tasks which were im- 
possible using classical physics) or illustrate fundamen- 
tal issues of quantum mechanics The final list was 
rather short: Einstein-Podolsky-Rosen-Bohm-Bell states 
of two particles ||, ^, Greenberger-Horne-Zeilinger 
(GHZ) states of three or more qubits Werner (mixed) 
states Hardy states (pure nonmaximally entangled 
states of two particles) Q], Horodecki "bound" states 
(entangled mixed states from which no pure entangle- 
ment can be distilled) and W states of three qubits 
1^ . Curiously, most of them were first introduced in con- 
nection with Bell's theorem, and some appeared in the 
course of the classification of entanglement. Surprisingly, 
none of them was originally introduced as the answer to 
a practical problem without classical solution (although 
most of them have later found numerous applications 
0, 0, 0, |l|). 

Here we shall introduce three apparently unrelated 
problems without classical solution and then propose a 
solution for all of them, using quantum mechanics. Com- 
mon to all these solutions is the use of a family of quan- 
tum states. 

(1) The N strangers problem. — The scenario for this 
problem is an extension to a high number N of players of 
the situation described in Patricia Highsmith's novel and 
Alfred Hitchcock's movie Strangers on a Train [ pO| : N 
complete strangers Ai [i — \^ . . . , N), meet on a train. Ai 
wants Bi dead. During small talk, one suggests that an 
"exchange" murder between N complete strangers would 
be unsolvable. After all, how could the police find the 
murderer when he/she is a total and complete stranger 
with absolutely no connection whatsoever to the victim? 
Ai could kill Bk, etc. |2|]. However, such a plan suffers 
from an important problem: if all the players know who 
the murderer of each victim is, then the whole plan is 
vulnerable to individual denunciations. Alternatively, if 
the distribution of victims is the result of a secret lottery, 
how could the murderers be assured that the lottery was 
not rigged and that nobody had contrived the result or 
could ascertain it? 

The problem is then how to distribute the victims 



{Bi}'^' among the murderers {^^jf , which share no pre- 
vious secret information nor any secure classical channel, 
in a way that guarantees that each murderer Ai knows 
only the identity of his/her victim and that nobody else 
(besides the murderers) knows anything about the as- 
signment of the victims. 

(2) The secret sharing problem. — This problem was al- 
ready described, for iV = 3, in It could arise in the 
following context: Ai wants to have a secret action taken 
on her behalf at a distant location. There she has — 1 
agents, A2, A3, An who carry it out for her. Ai 
knows that some of them are dishonest, but she does not 
know which one it is. She cannot simply send a secure 
message to all of them, because the dishonest ones will 
try to sabotage the action, but it is assumed (as in [p^) 
that if all of them carry it out together, the honest ones 
will keep the dishonest ones from doing any damage. 

The problem is then that Ai wishes to convey a cryp- 
tographic key to A2, A3, . . . , A]\j in such a way that 
none of them can read it on their own, only if all the 
Ai {i — 2,3,..., N) collaborate. In addition, they wish 
to prevent any eavesdropper from acquiring information 
without being detected. It is assumed that Ai shares 
no previous secret information nor any secure classical 
channel with her agents. 

Different quantum solutions to this problem for = 3 
has been proposed using either GHZ ^ or Bell states 
JlGf . Below we shall propose a different solution for any 
N which exhibits some additional advantages. 

(3) The liar detection problem. — Let us consider the 
following scenario: three parties A, B, and C are con- 
nected by secure pairwise classical channels. Let us sup- 
pose that A sends a message m to B and C, and B sends 
the same message to C. If both A and B are honest, then 
C should receive the same m from A and B. However, A 
could be dishonest and send different messages to B and 
C, ruAB 7^ (Fig- 07 left), or, alternatively, B could 
be dishonest and send a message which is different to the 
one he receives, msc 7^ "z^s (Fig. ^ right). For C the 
problem is to ascertain without any doubt who is being 
dishonest. This problem is interesting for classical infor- 
mation distribution in pairwise connected networks. The 
message could be a database and the dishonest behavior 
a consequence of an error during the copying or distribu- 
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FIG. 1: The liar detection problem. Left: A is a liar because 
she sends diflterent messages to B and C. Right: B is a liar 
because he sends C a message different to the one he received 
from A. The task is for C to identify who is being dishonest, 
A or B. 



tion process. This problem has no solution by classical 
means. It is at the heart of a slightly more complicated 
problem in distributed computing called the Byzantine 
agreement problem p2| , a version of which has been re- 
cently solved using quantum means by Fitzi, Gisin, and 
Maurer Indeed, the solution for our liar detection 

problem is based on theirs. 

The next step is to show that all of these problems can 
be solved if each of the N participants are in possession of 
a sequence of numbers with the following properties: (i) 
It is random (i.e., generated by an intrinsically unrepeat- 
able method which gives each possible number with the 
same probability of occurrence), (ii) The possible num- 
bers are integers from to — 1. (iii) If a number i is at 
position j of the sequence of party fc, i is not at position 
j in the sequence of a different party, (iv) Each party 
knows only his/her own sequence, (v) Nobody else (be- 
sides the parties) knows the sequences. Properties (iv) 
and (v) are difficult to accomplish using classical tools 
due to the fact that information transmitted in classical 
form can be examined and copied without altering it in 
any detectable way. However, as quantum key distribu- 
tion protocols show [^0[ |2^, quantum information does 
not suffer from such a drawback. 

Assuming we have a reliable method to generate se- 
quences of numbers with properties (i) to (v) among N 
distant parties, a method that will be presented below, 
then the solutions to the above problems are as follows. 

Solution to the N strangers problem. — Each victim Bi 
is assigned a label, taken from to — 1. If murderer 
Ai^s sequence starts with j, then Ai must kill Bj, etc. 
The remaining entries of the sequence can be used for 
subsequent rounds. The result tells every murderer who 
his/her victim is in such a way that prevents any mur- 
derer (or even a small group of them) from denouncing 
or blackmailing another. The only way to ascertain with 
certainty who murdered Bj is that all the other murder- 
ers confess pst . 

Solution to the secret sharing problem. — The key is de- 
fined as Ai's sequence. The only way to reveal it is to 
make the remaining A'^ — 1 parties share their respective 



sequences; the key is then composed by the missing re- 
sults. If a dishonest party D declares a result which is 
different to his/her actual result, then there is a prob- 
ability l/(r — 1), where r is the number of honest par- 
ties which have not yet declared their results, that other 
honest party H has obtained that result. Then H would 
stop the process, so Alice's key (and thus Alice's action) 
would remain safe (dishonest parties cannot sabotage Al- 
ice's action if they do not know what it is). The order 
in which the agents declare their respective results must 
change from round to round to avoid any dishonest party 
being always the last to declare. 

Solution to the liar detection problem. — Let us sup- 
pose that the message m is a trit value 0, 1, or 2. The 
three parties agree to use the following protocol: (I) If 
the transmitted message is m^ , then the sender i must 
also send j the list Ij-™'^"* of positions in his/her sequence 
in which the number ruij appears. Note that if the se- 
quences are random and long enough then any l^J^'^^ must 
contain about one third of the total length L of the se- 
quences. (II) The receiver j would not accept any mes- 
sage if the intersection between the received list Zj-™'^"* 

and his/her list zj'"'^-* is not null nor if Z^-™'^'' <C L/3 el- 
ements. We will assume that requirements (I) and (II) 
force the dishonest one to send correct but perhaps in- 
complete lists. Otherwise, if i sends a list containing n 
erroneous data, then the probability that j does not ac- 
cept the message rriy would be (2" — l)/2". In addition, 

(III) B must send C the list Z^^^^'' containing the se- 
quence he has (supposedly) received from A. Therefore, 
when C finds that tuac i^bC: she has received three 
lists to help her to find out whether it is A or B who is 
being dishonest. 

According to rules (I) to (III), if B wants to be dishon- 
est Ibc^'^'^'^^b^^^ must necessarily be asubset of 
because B does not know l^^'^'^'\ However, the length 
of is about L/3, while C is expecting B to send 

her two lists with a total length of 2L/3; then C would 
conclude that B was being dishonest. Alternatively, if it 
is A who is being dishonest, the lengths of the two lists 
that C received from B would total about 2L/3; then C 
would conclude that A was being dishonest. 

The next step is to present a method to generate 
among N distant parties sequences of numbers with prop- 
erties (i) to (iv). A possible quantum solution, probably 
not the only one, but maybe the most natural, is by dis- 
tributing among all N parties an iV-particle iV-level sin- 
glet state of total spin zero. For arbitrary N these states 
can be expressed as 

\Sn) = ^^ J2i-lY\^J...n) (1) 

permutations 
of 01...(N-1) 

where t is the number of transpositions of pairs of 
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elements that must be composed to place the ele- 
ments in canonical order {i.e., 0,1,2, N — 1) and 
|01 . . . (A^ — 1)) denotes the tensor product state |0) 
|l)(g)---(K)|A^ — 1). Particular examples of \Sn) are as 
follows: 



\S2) - 
1^3) = 

\S,) = 



|10», (2) 
^(1012) -1021)- |102) + |120) + 
|201) - |210», (3) 
^(10123) - 10132) - 10213) + |0231) + 
|0312) - |0321) + 13210)). (4) 



If we identify subsystems with spin-(iV — l)/2 particles 
and associate the state |s) with the eigenvalue s — {N — 
l)/2 of the spin observable in some fixed direction, then 
ISn) is the only state of N particles of spin-(A^ — l)/2 
which has total spin zero. 

The described solutions assume that the N parties 
share a large collection of A^-level systems in the {Sn) 
state. This requires a protocol to distribute and test 
these states between the N parties such that at the end 
of the protocol either all parties agree that they share 
a \Sn} state (and then they can rehably apply the de- 
scribed solutions), or all of them conclude that something 
went wrong (and then abort any subsequent action). For 
A'' = 3 such a distribute-and-test protocol is explicitly 
described in |2|] and can be easily be generalized to any 
> 3. The test requires that the parties compare a 
sufficiently large subset of their particles which are sub- 
sequently discarded. 

For our purposes, some interesting properties of the 
states \Sn) are: 

(a) They provide correlated results. As can be easily 
seen in Eq. (|l|) , whenever the A^ parties measure the spin 
of the A^ separated particles along the direction used in 
Eq. (p, each of them finds a different result in the set 
{0, . . . , A^ — 1}; thus such results satisfy requirements (ii) 
and (iii). 

(b) Moreover, \Sn) are N-lateral rotationally invari- 
ant. This means that if we act on any of them with the 
tensor product of the A^ rotation operators referring to all 
the particles for any arbitrary rotation, the result will be 
to reproduce the same state (within a possible phase fac- 
tor). Therefore, whenever the A'^ parties measure the spin 
of the A^ separated particles along any direction (but it 
must be the same direction for everyone), each of them 
finds a different result in the set {0, . . . ,N — 1}; thus 
such results satisfy requirements (ii) and (iii). There- 
fore, the direction of measurement could be randomly 
chosen and publicly announced (once the particles have 
been distributed among the parties) before any set of 
measurements. 

(c) In order to accomphsh (i) , (iv) , and (v) , an essential 
property is nonseparability, that is, the quantum predic- 
tions for the states \Sn) cannot be reproduced by any 
local hidden variables model in which the results of the 



spin measurements are somehow determined before the 
measurement. To show the nonseparability of \Sn) we 
have to study whether they violate Bell's inequalities de- 
rived from the assumptions of local realism. Most Bell's 
inequalities require two alternative local dichotomic (tak- 
ing values — 1 or 1 ) observables Aj and Bj on each parti- 
cle j. To test nonseparability, we will use the dichotomic 
local observables proposed by Peres in A Peres' ob- 
servable Ak can be operationally defined as follows: to 
measure Ak, first measure the spin component of particle 

(k) 

k along direction A, S\' . If particle fc is a spin-s particle, 

(k) 

then measuring S'^' could give 2s -I- 1 different results. 
Then assign value 1 to results s, s — 2, etc., and value 
— 1 to results s — 1, s — 3, etc. The operator representing 
observable Ak can be written as 



Ai 



(k) 



m)(4'=) 



(5) 



where |<S'^'^'* = m) is the cigcnstatc of the spin component 
along direction A of particle k. 

Probably the simplest way to show the nonseparabil- 
ity of the \Sn) states is by considering the following 
scenario: A^ distant observers share A^ A^-level particles 
in the \Sn) state; the N — m observers can choose be- 
tween measuring Aj ~ A and Bj = a; the remaining 
m observers can choose between measuring Ak = B and 
Bk = b. Then nonseparability can be tested by means 
of the following Bell's inequality, which generalizes to 
A^ particles the Clauser-Horne-Shimony-Holt (CHSH) in- 
equality p8[ 



\ENiA, . . . , A, B, . . . , B) + En{A, . . . , A,b, . . . ,b) + 
EN{a, . . . ,a,B, . . . ,B) - EN{a, . . . ,a,b, . . . ,b)\ <2. (6) 

Note that this inequality uses only a subset of all pos- 
sible correlation functions (for instance, it does not use 
Eisi{A, a, . . . ,a, B, . . . , B)). Restricting our attention to 
Peres' observables, for the states \Sn), the correlation 
function E^\A, . . . , A, B, . . . , B), which represents the 
expectation value of this product of the results of measur- 
ing, for instance, N—m observables A, and m observables 
B is given by 



E 



N 



(N-i) _ / -,Nf(jv/2) 1 sin(A^6>^B) 

1 sin[(A^ + 1)^^^b] 



N + 2 



1 



(7) 

(,8) 



where 6ab is the angle between directions A and B and 
f{x) gives the greatest integer less than or equal to x. 
In case of m = 1, that is, using correlation functions of 
the -E^""'^'' type, we have found that states |5„) violate 
inequality (g) for any A'^. The maximum violation for 
Af = 2 is 2V2, for A^ = 3 is 2.552, and for A^ -> oo tends 
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to 2.481. In case of m = 2, that is, using correlation func- 
tions of the e\^~^^ type, we have found that the states 
\Sn) violate inequality (^) for any TV. The maximum vi- 
olation for iV = 4 is 2.418, for iV = 5 is 2.424 and for 
N ^ oo tends to 2.481. 

(d) Nonseparability is robust against the loss of any 
number of parties if they can publicly announce the re- 
sults of their measurements. For instance, let us suppose 
that N — 2 observers measure the spin along the same 
direction A and publicly announce their results. Then, if 
the missing results are j and fc, the state shared by the 
remaining two observers is 



|cr)Ar = 



1 



{\SA^j, SA^k)N-\SA = k, SA=j)N) ■ (9) 



Note that |CT)Ar is formally similar to the singlet state of 
two qubits. However, it belongs to the A^^-dimensional 
Hilbert space TCn ^T^-n and not to 7^2 ^ '^2, and there- 
fore does not exhibit rotational symmetry. For Peres' 
observables, the corresponding correlation function is 



E%{A,B) = {-1) 



^cos^-i 



(10) 



The states \(j)n violate the CHSH inequality. For N = 2 
the maximum violation is 2^/2, for N = 3 the maximum 
violation is 2.414, and ior N ^ oo tends to 2.324. 

A similar situation occurs when any number p of ob- 
servers (not necessarily two) measure the same spin com- 
ponent and publicly announce their results. Then, the 
state shared by the remaining N — p observers is for- 
mally similar to |iSjv-p), but belongs to a iV^-dimensional 
Hilbert space 'Hn^'Hn- Therefore, in the secret sharing 
scenario, if some of the parties get caught by the enemy, 
and they are nevertheless able to publicly announce their 
results, the remaining parties still share pseudo |5Ar_p) 
states and could still use them for secret sharing. 

Only very recently has it been possible to prepare opti- 
cal analogs to the singlet states of two A^-level systems for 
every N and to test Bell inequalities for two qutrits 
pO| . So far, of the states \Sn), only the simplest one, the 
singlet state of two qubits, has been created in a labora- 
tory. Preparing these states for A'' > 3 is a formidable 
physical challenge. The aim of this Letter has been to 
point out some potential applications of these states in 
order to stimulate the interest in that challenge. 
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